Question 1

Are the strings cryptographically secure?

Accepted Answer

Yes. Each character is selected using the browser's Web Crypto API (crypto.getRandomValues), a cryptographically secure random source, so the strings are suitable for tokens and keys.

Question 2

What does “exclude ambiguous characters” do?

Accepted Answer

It removes characters that are easy to confuse — 0 and O, and 1, l, and I — so the string is easier to read, type, and dictate without errors.

Question 3

How long can the string be?

Accepted Answer

Up to 256 characters for the random body, plus whatever prefix or suffix you add.

Question 4

Can I control the alphabet?

Accepted Answer

Yes. Mix uppercase, lowercase, numbers, and symbols freely. The live character-pool size shows how many distinct characters each position can use.

Question 5

Is anything uploaded?

Accepted Answer

No. Strings are generated entirely in your browser and never sent anywhere.

Question 6

What does the entropy meter mean?

Accepted Answer

Entropy measures how hard a string is to guess: length × log2(character-pool size), in bits. 128 bits or more is considered unguessable for secrets — a 24-character string from a 62-character alphanumeric pool carries about 143 bits.

Question 7

Can I generate many strings at once?

Accepted Answer

Yes — set 'How many' up to 100 and each string appears on its own line, each independently random. Copy them all or download the batch for seeding a database or spreadsheet.

Question 8

Can I export as JSON, CSV, SQL, or .env?

Accepted Answer

Yes. Choose a format under 'Export as' and the copy and download buttons emit the batch pre-formatted: a JSON array like ["a","b"], comma-separated CSV, SQL VALUES rows like ('a'), ('b'), or a .env block like TOKEN_1=a. It saves you reformatting a batch by hand when seeding data or config.

Question 9

How do I generate a Base32 secret for 2FA/TOTP?

Accepted Answer

Click the Base32 preset. It uses the RFC 4648 alphabet (A–Z and 2–7) with no ambiguous characters, which is the format authenticator apps expect for otpauth:// TOTP secrets. The default 32-character length gives a strong secret; adjust the length if your provider expects a specific size.

Question 10

What are the NanoID and Base58 presets?

Accepted Answer

NanoID produces a 21-character URL-safe ID from A–Z, a–z, 0–9, plus _ and - — a compact, collision-resistant alternative to UUIDs for URLs and database keys. Base58 uses the Bitcoin-style alphabet that omits 0, O, I, and l, so identifiers are safe to copy by hand. For standard UUIDs, use the dedicated UUID generator.

Generate random strings

Your random string

Customize